topic Re: Print secure services using Web Tier Authentication in ArcGIS Enterprise Portal Questions

Print secure services using Web Tier Authentication

RavinHasseea1 — Mon, 27 Jun 2016 13:53:51 GMT

Hi I am using Portal 10.4 and have configured the portal printing tools to an ArcGIS 10.3.1 printing service. We have IWA set up for both the portal and ArcGIS Server. We have also set up trusted servers in portal.

When using the default print widget in portal, I am getting the error message "Error, try again"

In ArcGIS Server log, I get

"Error executing tool. Export Web Map Task Job ID: j150b832f961f4960833c46084e3ba118 : Layer "My Map": Unable to connect to map server at https://servername/arcgis/rest/services/Basemaps/OSBasemaps/MapServer. Failed to execute (Export Web Map). Failed to execute (Export Web Map Task)."

I have also tried running the print service from its rest end point. It comes up with the same error message.

We have tried the default ArcGIS Server printing services and also a custom service with embedded credentials (Printing maps that contain secured services—Documentation (10.3 and 10.3.1) | ArcGIS for Server ). All the services are currently accessible to everyone.

Any suggestions ?

Re: Print secure services using Web Tier Authentication

MichaelRobb — Wed, 29 Jun 2016 20:24:44 GMT

Are you using a Proxy?

Re: Print secure services using Web Tier Authentication

RavinHasseea1 — Fri, 01 Jul 2016 16:40:09 GMT

No we are simply using the print widget available in Web App Builder in portal and configure the utility services to AGS printing service.

Re: Print secure services using Web Tier Authentication

JonathanQuinn — Fri, 01 Jul 2016 18:14:04 GMT

Is your ArcGIS Server Windows Service running as a domain user that has access to the services? That account should be the one actually making the request to the services within the web app, and since you're using IWA, see what account Server is running as. As a test, you can try to run it as your own account and then try to print, as it seems you have access to the services.

Re: Print secure services using Web Tier Authentication

CésarPires — Mon, 25 Jul 2016 11:58:59 GMT

I have the same problem.

My services are running on ArcGIS for Server 10.4.1 and i get the same error when trying to print secures services with IWA.

ArcGIS for Server is running as a domain user and custom print services is configured with the same user and password.

Re: Print secure services using Web Tier Authentication

RavinHasseea1 — Mon, 25 Jul 2016 12:12:57 GMT

My ArcGIS Server service is running as a domain user with access to the services. I have also tried my own account, but it makes no difference.

Re: Print secure services using Web Tier Authentication

MichaelRobb — Mon, 25 Jul 2016 20:29:26 GMT

Hi Cesar,

It should all work. I have a document with explicit details, I cant post it, but can provide snippets and direction.

Summary:

Create a custom Geoprocessing Print service which holds Preconfigured secure connections which are set using a User name that has access to ALL Secure Services to allow secure services print through using Windows Authentication / Web-Tier

In IIS - WIndows Authentication enabled on the ArcGIS Server Web Adaptor.

Have Web-Tier authentication enabled on ArcGIS Server (using manager or admin)

Create a new Toolbox under My Toolboxes using ArcCatalog
Copy Export Web Map GP Tool from System Toolbox >> Server Tools >> Printing TO the newly created toolbox.
Create new AGS Connection

This connection will be a User that will have access to ALL ArcGIS Server Services that are locked.

This connection MUST be a USER type connection with ArcGIS Server

4. Name the AGS Connection Appropriately

5. Right t click on new GP >> Edit

6. Add the newly created AGS Connection File

7. Validate the URL and AGS Connection

8. Repeat steps for multiple servers (in this case, I do only 1 as we have traffic go through a NLB)

9. Open an ArcMap Session and Add the custom toolbox

10. Add some data to the mapdoc (which the server has visibility to - registered)

11. Double click the custom Print GP

12. Double click the custom Print GP

13. In the results dialog, right click on the successful print and share as >> Geoprocessing service

14. Publish the service

15. name the service

16. Configure the custom GP Service in the service editor

(e.g. Asynchronous execution mode) custom templates etc...

17.Analyze

18. Publish

When you create the custom Geoprocessor, the connection used MUST be a USER type connection with ArcGIS Server, not Publisher or Admin. Please ensure this.

Re: Print secure services using Web Tier Authentication

MichaelRobb — Mon, 25 Jul 2016 20:29:51 GMT

Hi Ravin,

It should all work. I have a document with explicit details, I cant post it, but can provide snippets and direction.

Summary:

In IIS - WIndows Authentication enabled on the ArcGIS Server Web Adaptor.

Have Web-Tier authentication enabled on ArcGIS Server (using manager or admin)

Create a new Toolbox under My Toolboxes using ArcCatalog
Copy Export Web Map GP Tool from System Toolbox >> Server Tools >> Printing TO the newly created toolbox.
Create new AGS Connection

This connection will be a User that will have access to ALL ArcGIS Server Services that are locked.

This connection MUST be a USER type connection with ArcGIS Server

4. Name the AGS Connection Appropriately

5. Right t click on new GP >> Edit

6. Add the newly created AGS Connection File

7. Validate the URL and AGS Connection

8. Repeat steps for multiple servers (in this case, I do only 1 as we have traffic go through a NLB)

9. Open an ArcMap Session and Add the custom toolbox

10. Add some data to the mapdoc (which the server has visibility to - registered)

11. Double click the custom Print GP

12. Double click the custom Print GP

13. In the results dialog, right click on the successful print and share as >> Geoprocessing service

14. Publish the service

15. name the service

16. Configure the custom GP Service in the service editor

(e.g. Asynchronous execution mode) custom templates etc...

17.Analyze

18. Publish

When you create the custom Geoprocessor, the connection used MUST be a USER type connection with ArcGIS Server, not Publisher or Admin. Please ensure this.

Re: Print secure services using Web Tier Authentication

PaulDavidson1 — Mon, 25 Jul 2016 21:50:35 GMT

Michael: I suspect there are going to be many of us thanking you for this posting!

Re: Print secure services using Web Tier Authentication

CésarPires — Tue, 26 Jul 2016 11:50:06 GMT

Problem solved

The loopback security check of windows server 2008 R2 was bloking windows authetication of the print service.

Re: Print secure services using Web Tier Authentication

MichaelRobb — Tue, 26 Jul 2016 14:40:06 GMT

Glad you figured it out. That is a five year old item for sure though. .NET 3.5SP1. Loopback only applies to the machine server the request came from though. You should have had no issues from an external machine. ??

Re: Print secure services using Web Tier Authentication

CésarPires — Tue, 26 Jul 2016 14:58:23 GMT

Yes. Everything was working fine from a external machine except the print service.

Print service was blocked wen trying to authenticate in the same machine that was serving him.

Re: Print secure services using Web Tier Authentication

simoxu — Wed, 08 Feb 2017 00:16:28 GMT

Hi Michael, thanks for the detailed steps, It works!

Re: Print secure services using Web Tier Authentication

Rebecca_Fong — Mon, 31 Jul 2017 12:33:01 GMT

I tried this process and my print services, just sits there. No error message. Is anyone having the same issues

Re: Print secure services using Web Tier Authentication

OliviaDeSimone — Fri, 13 Oct 2017 15:50:53 GMT

Thank you for these helpful steps. I am not quite able to get this to work and have a couple questions:

When you say, "When you create the custom Geoprocessor, the connection used MUST be a USER type connection with ArcGIS Server, not Publisher or Admin," you don't mean when you are actually publishing the service, right? It isn't possible to publish a service on a User connection. Do you mean that it is important to make sure that you edit the tool to include the user connection URL in the "Configure Secure GIS Server Connections" window?
Does anyone know is this workflow still works at ArcGIS Server 10.5?

Re: Print secure services using Web Tier Authentication

SrikanthKusam1 — Wed, 06 Dec 2017 11:55:40 GMT

I tried to publish the GP Service to ArcGIS Server 10.5.1 using above steps, But ArcMap crashing while publishing.

Re: Print secure services using Web Tier Authentication

EricJackson1 — Wed, 03 Jan 2018 22:34:04 GMT

Thanks! This worked for me too with a fresh setup of 10.5.1, Portal, Federated Server and Data Store Server all in separate boxes.

Odd thing was the out of the box print service worked with map services on the federated server, but not Hosted feature services from the federated server/data store server. All of the services were shared to Everyone.

Eric

Re: Print secure services using Web Tier Authentication

arunepuri1 — Thu, 01 Nov 2018 16:05:27 GMT

Hi Robb,

How we can mimic the same with ArcGIS pro. As pro "Export Web Map" is script tool, when right click => edit clicked=> it's showing python script. Is there any code block needs to be included to include ArcGIS user connection with credentials.

We are using default utility print service in Portal web app builder application=> print widget

Printing is working fine for external (ESRI) or other sample services. when we are using internal ArcGIS Server hosted services we are getting below error message in console and ArcGIS Server log.

{"error":{"code":400,"extendedCode":-2147467261,"message":"Unable to complete operation.","details":["Error executing tool. Export Web Map Task : Failed to create layer from service at https://XXXXXXXXXXXXXXx/_Map/MapServer.\nFailed to create layer from service at https://XXXXXXXXXXXX/plate/FeatureServer/2.\nFailed to execute (Export Web Map).\nFailed to execute (Export Web Map Task)."]}}

Thanks in Advance.

Thanks,

Arun E

Re: Print secure services using Web Tier Authentication

AndresCastillo — Mon, 03 Aug 2020 21:58:12 GMT

error executing tool. Export Web Map Task : Layer "SpatialRecord_UT_Pro_FS - County Manifest": Failed to create layer from service at https://arcgisserver.domain.com/portal/sharing/servers/itemid/rest/services/FSName/FeatureServer/1. ERROR: code:403, You do not have permissions to access this resource or perform this operation. Access to this resource is forbidden, regardless of authorization. Failed to execute (Export Web Map). Failed to execute (Export Web Map Task).

Utilities/PrintingTools.GPServer

Appears as if ArcGIS Server Print tools does not have access to external secured feature service.

https://community.esri.com/thread/87790

https://community.esri.com/thread/179089

https://community.esri.com/videos/3051

Our solution:

We added an external secured service to our portal as an item, and save credentials with the item.

We have two ways it works:

share the external secured service portal item with everyone within the network domain.

This will allow the ArcGIS Server account (a domain user within the network) access to get the credentials from the portal item, so the credentials can be read by that ArcGIS Server's print service.

The downside of this is that now everyone within the network domain of your company can print this external secured service portal item.

Share the external secured service portal item with specific groups within the portal.

Add the ArcGIS Server account (a domain user within the network) as a portal member.

Add the Server account portal user as a member of a group you shared the external secured service portal item with.

This will allow the ArcGIS Server account (a domain user within the network) access to get the credentials from the portal item, so the credentials can be read by that ArcGIS Server's print service.

The downside of doing this is that it takes up a portal user type license, which costs money.

A possible third way this will work is following Esri docs:

Print maps that contain secured services—Documentation (10.5) | ArcGIS Enterprise

Re: Print secure services using Web Tier Authentication

GustavoMartineli12 — Fri, 22 Nov 2024 19:22:47 GMT

Good afternoon everyone,
I need to publish a printing service to print authenticated services, like the one in the example, but in 11.3 I couldn't find how to do it.